@effect-agent/storage-cloudflare 0.1.0-beta.9 → 0.1.0-beta.91

package/src/{routing.ts → PortRouting.ts}

@@ -1,23 +1,26 @@
+import { Context, Effect, Layer, Option, Predicate, Schema, Stream } from "effect";
 import {
   AdmissionIndeterminate,
-  AppendConflict,
+  AdmissionConflict,
+  AdmissionPolicyError,
   ChildAttachmentSnapshot,
-  ConversationMaterialization,
-  ConversationNotMaterialized,
-  ConversationStore,
-  ConversationStoreError,
-  FenceRejected,
   JoinedToHost,
   LedgerError,
   RecoverySnapshot,
   SettlementConflict,
   SubmissionLedger,
   SubmissionLookupById,
-  type AdmissionConflict,
   type SubmissionLookupByKey,
   type SubmissionSnapshot,
-} from "@effect-agent/session";
-import { Context, Effect, Layer, Option, Schema, Stream } from "effect";
+} from "effect-agent/submission-ledger";
+import {
+  AppendConflict,
+  ThreadMaterialization,
+  ThreadNotMaterialized,
+  ThreadStore,
+  ThreadStoreError,
+  FenceRejected,
+} from "effect-agent/thread-store";
 
 import {
   boundPortDiagnostic,
@@ -55,13 +58,13 @@ import {
   type PortRequestEnvelope,
   type PortResponse,
   type PortResult,
-} from "./port-protocol.ts";
+} from "./PortProtocol.ts";
 
-type ConversationId = ConversationMaterialization["conversationId"];
+type ThreadId = ThreadMaterialization["threadId"];
 type SubmissionId = SubmissionSnapshot["submissionId"];
 
-const ConversationIdSchema = ConversationMaterialization.fields.conversationId;
-const decodeConversationId = Schema.decodeUnknownEffect(ConversationIdSchema);
+const ThreadIdSchema = ThreadMaterialization.fields.threadId;
+const decodeThreadId = Schema.decodeUnknownEffect(ThreadIdSchema);
 
 /**
  * The ledger row bound routable Submission identities must respect (mirrors the local
@@ -76,7 +79,7 @@ const UUID_HEAD_PATTERN =
 
 /**
  * A transport could not deliver a port request to (or an answer from) the owning
- * Conversation's Durable Object. `retryable` carries the platform's own stub signal when one
+ * Thread's Durable Object. `retryable` carries the platform's own stub signal when one
  * exists. This error never crosses the wire — it is the CALLER-side evidence that the
  * authority was unreachable, which is exactly the case `AdmissionIndeterminate` was
  * specified for (SUB-031).
@@ -91,20 +94,37 @@ export class PortTransportError extends Schema.TaggedError<PortTransportError>()
   },
 ) {}
 
+const safeTransportDiagnostic = (cause: unknown): string => {
+  try {
+    const message = cause instanceof Error ? cause.message : cause;
+
+    return boundPortDiagnostic(typeof message === "string" ? message : String(message));
+  } catch {
+    return "[unavailable transport diagnostic]";
+  }
+};
+
+const transportRetryableSignal = (cause: unknown): boolean | undefined => {
+  if (!Predicate.isObjectKeyword(cause)) return undefined;
+  try {
+    const signal = Reflect.get(cause, "retryable");
+
+    return typeof signal === "boolean" ? signal : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
 /**
  * Build a `PortTransportError` from an arbitrary thrown transport cause, preserving the
  * platform stub's own `retryable` signal when present.
  */
 export const portTransportFailure = (target: string, cause: unknown): PortTransportError => {
-  const message = cause instanceof Error ? cause.message : String(cause);
-  let retryable: boolean | undefined;
-  if (typeof cause === "object" && cause !== null && "retryable" in cause) {
-    const signal = cause.retryable;
-    if (typeof signal === "boolean") retryable = signal;
-  }
+  const retryable = transportRetryableSignal(cause);
+
   return PortTransportError.make({
     target,
-    message: boundPortDiagnostic(message),
+    message: safeTransportDiagnostic(cause),
     ...(retryable === undefined ? {} : { retryable }),
     cause,
   });
@@ -112,42 +132,42 @@ export const portTransportFailure = (target: string, cause: unknown): PortTransp
 
 /**
  * Delivery of Schema-encoded port envelopes to the Durable Object that owns a FOREIGN
- * Conversation (plan §1.3, D-P6-3). The shipped implementation (platform-cloudflare, WP3)
+ * Thread (plan §1.3, D-P6-3). The shipped implementation (platform-cloudflare, WP3)
  * calls the owner's `portCall` over native Durable Object JS RPC via
- * `namespace.idFromName(conversationId)`; the protocol is transport-agnostic and any carrier
+ * `namespace.idFromName(threadId)`; the protocol is transport-agnostic and any carrier
  * that moves the encoded envelopes verbatim satisfies this service. Implementations MUST
  * surface every delivery problem as `PortTransportError` and must never fabricate an answer.
  */
-export class ConversationPortTransport extends Context.Service<
-  ConversationPortTransport,
+export class ThreadPortTransport extends Context.Service<
+  ThreadPortTransport,
   {
     readonly call: (
-      conversationId: ConversationId,
+      threadId: ThreadId,
       request: PortRequestEnvelope,
     ) => Effect.Effect<unknown, PortTransportError>;
   }
->()("@effect-agent/storage-cloudflare/ConversationPortTransport") {}
+>()("@effect-agent/storage-cloudflare/ThreadPortTransport") {}
 
 /** Construction options shared by both routed port Layers. */
 export interface RoutedPortOptions {
   /**
-   * The Conversation this Durable Object owns (the Object identity rule is
-   * `namespace.idFromName(conversationId)`). Requests addressed here execute on the local
-   * facet; requests addressed anywhere else route through the transport or fail fast typed.
+   * Decide whether this physical owner stores the addressed logical Thread. Local
+   * requests use the same SQLite facets; foreign requests use the transport or fail
+   * fast typed. The predicate determines placement, never caller authorization.
    */
-  readonly localConversationId: ConversationId;
+  readonly ownsThread: (threadId: ThreadId) => boolean;
 }
 
 /** Where one port request must execute. */
 type RouteTarget =
   | { readonly _tag: "local" }
-  | { readonly _tag: "foreign"; readonly conversationId: ConversationId };
+  | { readonly _tag: "foreign"; readonly threadId: ThreadId };
 
 const LOCAL: RouteTarget = { _tag: "local" };
 
 /**
- * Parse a DC-minted routable Submission identity — `{uuidv7}:{conversationId}`, split at the
- * FIRST `:` because the Conversation tail may itself contain colons (D-P6-5). This adapter
+ * Parse a DC-minted routable Submission identity — `{uuidv7}:{threadId}`, split at the
+ * FIRST `:` because the Thread tail may itself contain colons (D-P6-5). This adapter
  * minted the format at admission and is the ONLY component that parses it; identities that do
  * not carry the minted shape (no separator, non-UUID head, empty tail) fall back to the local
  * facet, which is the only authority this Object can consult without inventing an owner.
@@ -155,7 +175,7 @@ const LOCAL: RouteTarget = { _tag: "local" };
  * refused them at admission, so they cannot name any stored row anywhere.
  */
 const routableSubmissionTarget = (
-  localConversationId: ConversationId,
+  ownsThread: RoutedPortOptions["ownsThread"],
 ): ((operation: string, submissionId: string) => Effect.Effect<RouteTarget, LedgerError>) =>
   Effect.fn("DoPortRouting.routableSubmissionTarget")(function* (
     operation: string,
@@ -171,63 +191,49 @@ const routableSubmissionTarget = (
       });
     }
     const separator = submissionId.indexOf(":");
+
     if (separator === -1) return LOCAL;
     if (!UUID_HEAD_PATTERN.test(submissionId.slice(0, separator))) return LOCAL;
     const tail = submissionId.slice(separator + 1);
-    if (tail === localConversationId) return LOCAL;
-    return yield* decodeConversationId(tail).pipe(
-      Effect.map((conversationId): RouteTarget => ({ _tag: "foreign", conversationId })),
+
+    return yield* decodeThreadId(tail).pipe(
+      Effect.map((threadId): RouteTarget =>
+        ownsThread(threadId) ? LOCAL : { _tag: "foreign", threadId },
+      ),
       Effect.orElseSucceed(() => LOCAL),
     );
   });
 
-const isResultTag =
-  <Tag extends PortResult["_tag"]>(tag: Tag) =>
-  (result: PortResult): result is Extract<PortResult, { readonly _tag: Tag }> =>
-    result._tag === tag;
-
-const isAdmitConflict = (failure: PortFailure): failure is AdmissionConflict =>
-  failure._tag === "AdmissionConflict";
-const isAbortConflict = (failure: PortFailure): failure is SettlementConflict | JoinedToHost =>
-  failure._tag === "SettlementConflict" || failure._tag === "JoinedToHost";
-const noExtraFailure = (_failure: PortFailure): _failure is never => false;
-const isFenceRejected = (failure: PortFailure): failure is FenceRejected =>
-  failure._tag === "FenceRejected";
-const isAppendFailure = (
-  failure: PortFailure,
-): failure is ConversationNotMaterialized | AppendConflict | FenceRejected =>
-  failure._tag === "ConversationNotMaterialized" ||
-  failure._tag === "AppendConflict" ||
-  failure._tag === "FenceRejected";
-const isNotMaterialized = (failure: PortFailure): failure is ConversationNotMaterialized =>
-  failure._tag === "ConversationNotMaterialized";
+const NoAdditionalPortFailure = Schema.Never;
+const AbortPortFailure = Schema.Union([SettlementConflict, JoinedToHost]);
+const AppendPortFailure = Schema.Union([ThreadNotMaterialized, AppendConflict, FenceRejected]);
 
 /**
  * The fail-fast refusal for any foreign operation OUTSIDE the closed route-capable subset
  * (plan §1.3): honesty over accidental distribution.
  */
-const crossConversationLedgerError = (operation: string, target: string): LedgerError =>
+const crossThreadLedgerError = (operation: string, target: string): LedgerError =>
   LedgerError.make({
     operation,
     message:
-      `${operation} addressed to foreign Conversation ${target} is not route-capable; the ` +
+      `${operation} addressed to foreign Thread ${target} is not route-capable; the ` +
       "closed cross-Object subset is admit, markReady, lookup, resolveAdmission, " +
       "requestAbort, and recordChildSettled. Every other ledger operation is lane-local by " +
-      "construction and must execute inside the owning Conversation's Durable Object.",
+      "construction and must execute inside the owning Thread's Durable Object.",
   });
 
-const crossConversationStoreError = (operation: string, target: string): ConversationStoreError =>
-  ConversationStoreError.make({
+const crossThreadStoreError = (operation: string, target: string): ThreadStoreError =>
+  ThreadStoreError.make({
     operation,
     message:
-      `${operation} addressed to foreign Conversation ${target} is not route-capable; the ` +
+      `${operation} addressed to foreign Thread ${target} is not route-capable; the ` +
       "closed cross-Object subset is materialize, append, read (paged), inspectTail, and " +
       "export. Observation and checkpoints are lane-local by construction and must execute " +
-      "inside the owning Conversation's Durable Object.",
+      "inside the owning Thread's Durable Object.",
   });
 
-const makeTransportCall = (transport: ConversationPortTransport["Service"]) =>
-  Effect.fn("DoPortRouting.transportCall")(function* (target: ConversationId, call: PortRequest) {
+const makeTransportCall = (transport: ThreadPortTransport["Service"]) =>
+  Effect.fn("DoPortRouting.transportCall")(function* (target: ThreadId, call: PortRequest) {
     const encoded = yield* encodePortRequest(call).pipe(
       Effect.mapError((error) =>
         PortProtocolError.make({
@@ -235,7 +241,9 @@ const makeTransportCall = (transport: ConversationPortTransport["Service"]) =>
         }),
       ),
     );
+
     const raw = yield* transport.call(target, encoded);
+
     return yield* decodePortResponse(raw).pipe(
       Effect.mapError((error) =>
         PortProtocolError.make({
@@ -251,9 +259,9 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
   options: RoutedPortOptions,
 ) {
   const local = yield* SubmissionLedger;
-  const transport = yield* ConversationPortTransport;
+  const transport = yield* ThreadPortTransport;
   const transportCall: TransportCall = makeTransportCall(transport);
-  const submissionTarget = routableSubmissionTarget(options.localConversationId);
+  const submissionTarget = routableSubmissionTarget(options.ownsThread);
 
   const routeFailure =
     (operation: string, target: string) =>
@@ -261,7 +269,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
       LedgerError.make({
         operation,
         message: boundPortDiagnostic(
-          `Routed ${operation} to the Conversation Object owning ${target} failed: ${error.message}`,
+          `Routed ${operation} to the Thread Object owning ${target} failed: ${error.message}`,
         ),
         cause: error,
       });
@@ -272,31 +280,31 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
    * any failure outside the operation's declared surface — including protocol anomalies — is
    * folded into a `LedgerError` naming the anomaly instead of being erased or re-thrown raw.
    */
-  const foreignLedgerCall = <Tag extends PortResult["_tag"], ExpectedFailure extends PortFailure>(
+  const foreignLedgerCall = <ResultSchema extends Schema.Top, FailureSchema extends Schema.Top>(
     operation: string,
-    target: ConversationId,
+    target: ThreadId,
     call: PortRequest,
-    resultTag: Tag,
-    isExpectedFailure: (failure: PortFailure) => failure is ExpectedFailure,
-  ): Effect.Effect<Extract<PortResult, { readonly _tag: Tag }>, ExpectedFailure | LedgerError> =>
-    transportCall(target, call).pipe(
+    resultSchema: ResultSchema,
+    failureSchema: FailureSchema,
+  ): Effect.Effect<ResultSchema["Type"], FailureSchema["Type"] | LedgerError> => {
+    const isExpectedResult = Schema.is(resultSchema);
+    const isExpectedFailure = Schema.is(failureSchema);
+
+    return transportCall(target, call).pipe(
       Effect.mapError(routeFailure(operation, target)),
       Effect.flatMap(
-        (
-          response,
-        ): Effect.Effect<
-          Extract<PortResult, { readonly _tag: Tag }>,
-          ExpectedFailure | LedgerError
-        > => {
+        (response): Effect.Effect<ResultSchema["Type"], FailureSchema["Type"] | LedgerError> => {
           if (response._tag === "PortFailed") {
             const failure = response.failure;
+
             if (isExpectedFailure(failure)) return Effect.fail(failure);
             if (failure._tag === "LedgerError") return Effect.fail(failure);
+
             return Effect.fail(
               LedgerError.make({
                 operation,
                 message: boundPortDiagnostic(
-                  `The Conversation Object owning ${target} answered ${operation} with the ` +
+                  `The Thread Object owning ${target} answered ${operation} with the ` +
                     `out-of-contract failure ${failure._tag}: ${failure.message}`,
                 ),
                 cause: failure,
@@ -304,16 +312,18 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
             );
           }
           const result = response.result;
-          if (!isResultTag(resultTag)(result)) {
+
+          if (!isExpectedResult(result)) {
             return Effect.fail(
               LedgerError.make({
                 operation,
                 message:
-                  `The Conversation Object owning ${target} answered ${operation} with the ` +
-                  `mismatched result ${result._tag}; expected ${resultTag}.`,
+                  `The Thread Object owning ${target} answered ${operation} with the ` +
+                  `mismatched result ${result._tag}.`,
               }),
             );
           }
+
           return Effect.succeed(result);
         },
       ),
@@ -321,6 +331,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
         attributes: { operation, target },
       }),
     );
+  };
 
   /**
    * Routed `resolveAdmission` — where the S2 tri-state becomes real (plan §1.3): when the
@@ -331,7 +342,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
    * reached and reported its own storage failure.
    */
   const resolveForeignAdmission = (
-    target: ConversationId,
+    target: ThreadId,
     request: SubmissionLookupByKey,
   ): Effect.Effect<
     | AdmissionIndeterminate
@@ -342,10 +353,11 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
       Effect.flatMap((response) => {
         if (response._tag === "PortFailed") {
           if (response.failure._tag === "LedgerError") return Effect.fail(response.failure);
+
           return Effect.succeed(
             AdmissionIndeterminate.make({
               reason: boundPortDiagnostic(
-                `The Conversation Object owning ${target} answered resolveAdmission with the ` +
+                `The Thread Object owning ${target} answered resolveAdmission with the ` +
                   `out-of-contract failure ${response.failure._tag}: ${response.failure.message}`,
               ),
             }),
@@ -355,12 +367,13 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
           return Effect.succeed(
             AdmissionIndeterminate.make({
               reason: boundPortDiagnostic(
-                `The Conversation Object owning ${target} answered resolveAdmission with the ` +
+                `The Thread Object owning ${target} answered resolveAdmission with the ` +
                   `mismatched result ${response.result._tag}.`,
               ),
             }),
           );
         }
+
         return Effect.succeed(response.result.resolution);
       }),
       Effect.catchTags({
@@ -368,7 +381,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
           Effect.succeed(
             AdmissionIndeterminate.make({
               reason: boundPortDiagnostic(
-                `The Conversation Object owning ${target} is unreachable: ${error.message}`,
+                `The Thread Object owning ${target} is unreachable: ${error.message}`,
               ),
             }),
           ),
@@ -376,7 +389,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
           Effect.succeed(
             AdmissionIndeterminate.make({
               reason: boundPortDiagnostic(
-                `The answer of the Conversation Object owning ${target} could not be ` +
+                `The answer of the Thread Object owning ${target} could not be ` +
                   `understood: ${error.message}`,
               ),
             }),
@@ -387,15 +400,15 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
 
   const foreignLookupById = (
     operation: string,
-    target: ConversationId,
+    target: ThreadId,
     submissionId: SubmissionId,
   ): Effect.Effect<Option.Option<SubmissionSnapshot>, LedgerError> =>
     foreignLedgerCall(
       operation,
       target,
       LedgerLookupCall.make({ request: SubmissionLookupById.make({ submissionId }) }),
-      "LedgerLookupResult",
-      noExtraFailure,
+      LedgerLookupResult,
+      NoAdditionalPortFailure,
     ).pipe(
       Effect.map((result) =>
         result.submission === undefined ? Option.none() : Option.some(result.submission),
@@ -413,18 +426,24 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
     snapshot: RecoverySnapshot,
   ): Effect.fn.Return<RecoverySnapshot, LedgerError> {
     const operation = "ledger load recovery snapshot";
+
     const attachments = new Map(
       snapshot.childAttachments.map((attachment) => [attachment.childSubmissionId, attachment]),
     );
+
     let enriched = false;
+
     for (const reservation of snapshot.childReservations) {
       const childSubmissionId = reservation.childSubmissionId;
+
       if (childSubmissionId === undefined || attachments.has(childSubmissionId)) continue;
       const target = yield* submissionTarget(operation, childSubmissionId);
+
       // A local or opaque child identity was already answered authoritatively by the local
       // facet; absence there means the child admission never committed.
       if (target._tag !== "foreign") continue;
-      const child = yield* foreignLookupById(operation, target.conversationId, childSubmissionId);
+      const child = yield* foreignLookupById(operation, target.threadId, childSubmissionId);
+
       if (Option.isNone(child)) continue;
       attachments.set(
         childSubmissionId,
@@ -442,11 +461,14 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
     if (!enriched) return snapshot;
     // Rebuild in reservation (parent Tool Call) order, the order the local facet documents.
     const ordered: Array<ChildAttachmentSnapshot> = [];
+
     for (const reservation of snapshot.childReservations) {
       if (reservation.childSubmissionId === undefined) continue;
       const attachment = attachments.get(reservation.childSubmissionId);
+
       if (attachment !== undefined) ordered.push(attachment);
     }
+
     return RecoverySnapshot.make({ ...snapshot, childAttachments: ordered });
   });
 
@@ -454,14 +476,14 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
     capabilities: local.capabilities,
 
     admit: (request) =>
-      request.conversationId === options.localConversationId
+      options.ownsThread(request.threadId)
         ? local.admit(request)
         : foreignLedgerCall(
             "ledger admit",
-            request.conversationId,
+            request.threadId,
             LedgerAdmitCall.make({ request }),
-            "LedgerAdmitResult",
-            isAdmitConflict,
+            LedgerAdmitResult,
+            Schema.Union([AdmissionConflict, AdmissionPolicyError]),
           ).pipe(Effect.map((reply) => reply.result)),
 
     markReady: (request) =>
@@ -471,10 +493,10 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
             ? local.markReady(request)
             : foreignLedgerCall(
                 "ledger mark ready",
-                target.conversationId,
+                target.threadId,
                 LedgerMarkReadyCall.make({ request }),
-                "LedgerMarkReadyResult",
-                noExtraFailure,
+                LedgerMarkReadyResult,
+                NoAdditionalPortFailure,
               ).pipe(Effect.asVoid),
         ),
       ),
@@ -485,17 +507,17 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
             Effect.flatMap((target) =>
               target._tag === "local"
                 ? local.lookup(request)
-                : foreignLookupById("ledger lookup", target.conversationId, request.submissionId),
+                : foreignLookupById("ledger lookup", target.threadId, request.submissionId),
             ),
           )
-        : request.conversationId === options.localConversationId
+        : options.ownsThread(request.threadId)
           ? local.lookup(request)
           : foreignLedgerCall(
               "ledger lookup",
-              request.conversationId,
+              request.threadId,
               LedgerLookupCall.make({ request }),
-              "LedgerLookupResult",
-              noExtraFailure,
+              LedgerLookupResult,
+              NoAdditionalPortFailure,
             ).pipe(
               Effect.map((result) =>
                 result.submission === undefined ? Option.none() : Option.some(result.submission),
@@ -503,9 +525,9 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
             ),
 
     resolveAdmission: (request) =>
-      request.conversationId === options.localConversationId
+      options.ownsThread(request.threadId)
         ? local.resolveAdmission(request)
-        : resolveForeignAdmission(request.conversationId, request),
+        : resolveForeignAdmission(request.threadId, request),
 
     requestAbort: (request) =>
       submissionTarget("ledger request abort", request.submissionId).pipe(
@@ -514,10 +536,10 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
             ? local.requestAbort(request)
             : foreignLedgerCall(
                 "ledger request abort",
-                target.conversationId,
+                target.threadId,
                 LedgerRequestAbortCall.make({ request }),
-                "LedgerRequestAbortResult",
-                isAbortConflict,
+                LedgerRequestAbortResult,
+                AbortPortFailure,
               ).pipe(Effect.map((reply) => reply.intent)),
         ),
       ),
@@ -529,10 +551,10 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
             ? local.recordChildSettled(request)
             : foreignLedgerCall(
                 "ledger record child settled",
-                target.conversationId,
+                target.threadId,
                 LedgerRecordChildSettledCall.make({ request }),
-                "LedgerRecordChildSettledResult",
-                noExtraFailure,
+                LedgerRecordChildSettledResult,
+                NoAdditionalPortFailure,
               ).pipe(Effect.map((reply) => reply.outcome)),
         ),
       ),
@@ -540,23 +562,21 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
     // Every operation below is lane-local by construction (plan §1.3): a foreign address is
     // an out-of-contract call and fails fast typed instead of being quietly distributed.
     claim: (request) =>
-      request.conversationId === options.localConversationId
+      options.ownsThread(request.threadId)
         ? local.claim(request)
-        : Effect.fail(crossConversationLedgerError("ledger claim", request.conversationId)),
+        : Effect.fail(crossThreadLedgerError("ledger claim", request.threadId)),
 
     claimJoining: (request) =>
-      request.conversationId === options.localConversationId
+      options.ownsThread(request.threadId)
         ? local.claimJoining(request)
-        : Effect.fail(crossConversationLedgerError("ledger claim joining", request.conversationId)),
+        : Effect.fail(crossThreadLedgerError("ledger claim joining", request.threadId)),
 
     renewOwnership: (request) =>
       submissionTarget("ledger renew ownership", request.submissionId).pipe(
         Effect.flatMap((target) =>
           target._tag === "local"
             ? local.renewOwnership(request)
-            : Effect.fail(
-                crossConversationLedgerError("ledger renew ownership", target.conversationId),
-              ),
+            : Effect.fail(crossThreadLedgerError("ledger renew ownership", target.threadId)),
         ),
       ),
 
@@ -565,9 +585,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
         Effect.flatMap((target) =>
           target._tag === "local"
             ? local.releaseOwnership(request)
-            : Effect.fail(
-                crossConversationLedgerError("ledger release ownership", target.conversationId),
-              ),
+            : Effect.fail(crossThreadLedgerError("ledger release ownership", target.threadId)),
         ),
       ),
 
@@ -576,9 +594,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
         Effect.flatMap((target) =>
           target._tag === "local"
             ? local.markInputApplied(request)
-            : Effect.fail(
-                crossConversationLedgerError("ledger mark input applied", target.conversationId),
-              ),
+            : Effect.fail(crossThreadLedgerError("ledger mark input applied", target.threadId)),
         ),
       ),
 
@@ -587,9 +603,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
         Effect.flatMap((target) =>
           target._tag === "local"
             ? local.reserveSettlement(request)
-            : Effect.fail(
-                crossConversationLedgerError("ledger reserve settlement", target.conversationId),
-              ),
+            : Effect.fail(crossThreadLedgerError("ledger reserve settlement", target.threadId)),
         ),
       ),
 
@@ -598,9 +612,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
         Effect.flatMap((target) =>
           target._tag === "local"
             ? local.finalizeSettlement(request)
-            : Effect.fail(
-                crossConversationLedgerError("ledger finalize settlement", target.conversationId),
-              ),
+            : Effect.fail(crossThreadLedgerError("ledger finalize settlement", target.threadId)),
         ),
       ),
 
@@ -609,9 +621,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
         Effect.flatMap((target) =>
           target._tag === "local"
             ? local.markJoined(request)
-            : Effect.fail(
-                crossConversationLedgerError("ledger mark joined", target.conversationId),
-              ),
+            : Effect.fail(crossThreadLedgerError("ledger mark joined", target.threadId)),
         ),
       ),
 
@@ -620,9 +630,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
         Effect.flatMap((target) =>
           target._tag === "local"
             ? local.revertJoining(request)
-            : Effect.fail(
-                crossConversationLedgerError("ledger revert joining", target.conversationId),
-              ),
+            : Effect.fail(crossThreadLedgerError("ledger revert joining", target.threadId)),
         ),
       ),
 
@@ -631,7 +639,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
         Effect.flatMap((target) =>
           target._tag === "local"
             ? local.suspend(request)
-            : Effect.fail(crossConversationLedgerError("ledger suspend", target.conversationId)),
+            : Effect.fail(crossThreadLedgerError("ledger suspend", target.threadId)),
         ),
       ),
 
@@ -641,10 +649,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
           target._tag === "local"
             ? local.recordApprovalDecision(command)
             : Effect.fail(
-                crossConversationLedgerError(
-                  "ledger record approval decision",
-                  target.conversationId,
-                ),
+                crossThreadLedgerError("ledger record approval decision", target.threadId),
               ),
         ),
       ),
@@ -654,9 +659,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
         Effect.flatMap((target) =>
           target._tag === "local"
             ? local.markUnknown(request)
-            : Effect.fail(
-                crossConversationLedgerError("ledger mark unknown", target.conversationId),
-              ),
+            : Effect.fail(crossThreadLedgerError("ledger mark unknown", target.threadId)),
         ),
       ),
 
@@ -666,10 +669,7 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
           target._tag === "local"
             ? local.recordUnknownResolution(command)
             : Effect.fail(
-                crossConversationLedgerError(
-                  "ledger record unknown resolution",
-                  target.conversationId,
-                ),
+                crossThreadLedgerError("ledger record unknown resolution", target.threadId),
               ),
         ),
       ),
@@ -679,33 +679,35 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
         Effect.flatMap((target) =>
           target._tag === "local"
             ? local.reserveChildBudget(request)
-            : Effect.fail(
-                crossConversationLedgerError("ledger reserve child budget", target.conversationId),
-              ),
+            : Effect.fail(crossThreadLedgerError("ledger reserve child budget", target.threadId)),
         ),
       ),
 
-    // Reservation identities carry no Conversation address; the reservation row lives in the
+    // Reservation identities carry no Thread address; the reservation row lives in the
     // parent's own Object and these transitions are parent-lane-local by construction, so
     // they always execute on the local facet (which fails typed for an unknown row).
     attachChildToReservation: local.attachChildToReservation,
     beginChildBudgetRelease: local.beginChildBudgetRelease,
     releaseChildBudget: local.releaseChildBudget,
 
-    // The local scan IS the whole worklist: one Conversation per Object (durability §5).
+    // The local scan IS the whole worklist: one Thread per Object (durability §5).
     scanNonterminal: local.scanNonterminal,
 
+    readAbortIntent: (request) =>
+      submissionTarget("ledger read abort intent", request.submissionId).pipe(
+        Effect.flatMap((target) =>
+          target._tag === "local"
+            ? local.readAbortIntent(request)
+            : Effect.fail(crossThreadLedgerError("ledger read abort intent", target.threadId)),
+        ),
+      ),
+
     loadRecoverySnapshot: (request) =>
       submissionTarget("ledger load recovery snapshot", request.submissionId).pipe(
         Effect.flatMap((target) =>
           target._tag === "local"
             ? local.loadRecoverySnapshot(request).pipe(Effect.flatMap(enrichChildAttachments))
-            : Effect.fail(
-                crossConversationLedgerError(
-                  "ledger load recovery snapshot",
-                  target.conversationId,
-                ),
-              ),
+            : Effect.fail(crossThreadLedgerError("ledger load recovery snapshot", target.threadId)),
         ),
       ),
   });
@@ -716,50 +718,51 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
 const makeRoutedStoreServices = Effect.fn("DoPortRouting.makeRoutedStoreServices")(function* (
   options: RoutedPortOptions,
 ) {
-  const local = yield* ConversationStore;
-  const transport = yield* ConversationPortTransport;
+  const local = yield* ThreadStore;
+  const checkpoints = local.checkpoints;
+  const recoveryCheckpoints = local.recoveryCheckpoints;
+  const transport = yield* ThreadPortTransport;
   const transportCall: TransportCall = makeTransportCall(transport);
 
   const routeFailure =
     (operation: string, target: string) =>
-    (error: PortTransportError | PortProtocolError): ConversationStoreError =>
-      ConversationStoreError.make({
+    (error: PortTransportError | PortProtocolError): ThreadStoreError =>
+      ThreadStoreError.make({
         operation,
         message: boundPortDiagnostic(
-          `Routed ${operation} to the Conversation Object owning ${target} failed: ${error.message}`,
+          `Routed ${operation} to the Thread Object owning ${target} failed: ${error.message}`,
         ),
         cause: error,
       });
 
-  /** The store twin of `foreignLedgerCall` with `ConversationStoreError` as the base error. */
-  const foreignStoreCall = <Tag extends PortResult["_tag"], ExpectedFailure extends PortFailure>(
+  /** The store twin of `foreignLedgerCall` with `ThreadStoreError` as the base error. */
+  const foreignStoreCall = <ResultSchema extends Schema.Top, FailureSchema extends Schema.Top>(
     operation: string,
-    target: ConversationId,
+    target: ThreadId,
     call: PortRequest,
-    resultTag: Tag,
-    isExpectedFailure: (failure: PortFailure) => failure is ExpectedFailure,
-  ): Effect.Effect<
-    Extract<PortResult, { readonly _tag: Tag }>,
-    ExpectedFailure | ConversationStoreError
-  > =>
-    transportCall(target, call).pipe(
+    resultSchema: ResultSchema,
+    failureSchema: FailureSchema,
+  ): Effect.Effect<ResultSchema["Type"], FailureSchema["Type"] | ThreadStoreError> => {
+    const isExpectedResult = Schema.is(resultSchema);
+    const isExpectedFailure = Schema.is(failureSchema);
+
+    return transportCall(target, call).pipe(
       Effect.mapError(routeFailure(operation, target)),
       Effect.flatMap(
         (
           response,
-        ): Effect.Effect<
-          Extract<PortResult, { readonly _tag: Tag }>,
-          ExpectedFailure | ConversationStoreError
-        > => {
+        ): Effect.Effect<ResultSchema["Type"], FailureSchema["Type"] | ThreadStoreError> => {
           if (response._tag === "PortFailed") {
             const failure = response.failure;
+
             if (isExpectedFailure(failure)) return Effect.fail(failure);
-            if (failure._tag === "ConversationStoreError") return Effect.fail(failure);
+            if (failure._tag === "ThreadStoreError") return Effect.fail(failure);
+
             return Effect.fail(
-              ConversationStoreError.make({
+              ThreadStoreError.make({
                 operation,
                 message: boundPortDiagnostic(
-                  `The Conversation Object owning ${target} answered ${operation} with the ` +
+                  `The Thread Object owning ${target} answered ${operation} with the ` +
                     `out-of-contract failure ${failure._tag}: ${failure.message}`,
                 ),
                 cause: failure,
@@ -767,16 +770,18 @@ const makeRoutedStoreServices = Effect.fn("DoPortRouting.makeRoutedStoreServices
             );
           }
           const result = response.result;
-          if (!isResultTag(resultTag)(result)) {
+
+          if (!isExpectedResult(result)) {
             return Effect.fail(
-              ConversationStoreError.make({
+              ThreadStoreError.make({
                 operation,
                 message:
-                  `The Conversation Object owning ${target} answered ${operation} with the ` +
-                  `mismatched result ${result._tag}; expected ${resultTag}.`,
+                  `The Thread Object owning ${target} answered ${operation} with the ` +
+                  `mismatched result ${result._tag}.`,
               }),
             );
           }
+
           return Effect.succeed(result);
         },
       ),
@@ -784,118 +789,135 @@ const makeRoutedStoreServices = Effect.fn("DoPortRouting.makeRoutedStoreServices
         attributes: { operation, target },
       }),
     );
+  };
 
-  const routed = ConversationStore.of({
+  const routed = ThreadStore.of({
     materialize: (request) =>
-      request.conversationId === options.localConversationId
+      options.ownsThread(request.threadId)
         ? local.materialize(request)
         : foreignStoreCall(
-            "conversation materialize",
-            request.conversationId,
+            "thread materialize",
+            request.threadId,
             StoreMaterializeCall.make({ request }),
-            "StoreMaterializeResult",
-            isFenceRejected,
+            StoreMaterializeResult,
+            FenceRejected,
           ).pipe(Effect.asVoid),
 
     append: (request) =>
-      request.conversationId === options.localConversationId
+      options.ownsThread(request.threadId)
         ? local.append(request)
         : foreignStoreCall(
-            "conversation append",
-            request.conversationId,
+            "thread append",
+            request.threadId,
             StoreAppendCall.make({ request }),
-            "StoreAppendResult",
-            isAppendFailure,
+            StoreAppendResult,
+            AppendPortFailure,
           ).pipe(Effect.map((reply) => reply.result)),
 
     read: (request) =>
-      request.conversationId === options.localConversationId
+      options.ownsThread(request.threadId)
         ? local.read(request)
         : Stream.unwrap(
             foreignStoreCall(
-              "conversation read",
-              request.conversationId,
+              "thread read",
+              request.threadId,
               StoreReadPageCall.make({ request }),
-              "StoreReadPageResult",
-              isNotMaterialized,
+              StoreReadPageResult,
+              ThreadNotMaterialized,
             ).pipe(Effect.map((reply) => Stream.fromIterable(reply.records))),
           ),
 
     inspectTail: (request) =>
-      request.conversationId === options.localConversationId
+      options.ownsThread(request.threadId)
         ? local.inspectTail(request)
         : foreignStoreCall(
-            "conversation inspect tail",
-            request.conversationId,
+            "thread inspect tail",
+            request.threadId,
             StoreInspectTailCall.make({ request }),
-            "StoreInspectTailResult",
-            isNotMaterialized,
+            StoreInspectTailResult,
+            ThreadNotMaterialized,
           ).pipe(Effect.map((reply) => reply.tail)),
 
     export: (request) =>
-      request.conversationId === options.localConversationId
+      options.ownsThread(request.threadId)
         ? local.export(request)
         : foreignStoreCall(
-            "conversation export",
-            request.conversationId,
+            "thread export",
+            request.threadId,
             StoreExportCall.make({ request }),
-            "StoreExportResult",
-            isNotMaterialized,
+            StoreExportResult,
+            ThreadNotMaterialized,
           ).pipe(Effect.map((reply) => reply.export)),
 
-    // Observation and checkpoints are lane-local by construction (plan §1.3): the closed
-    // route-capable store subset is materialize/append/read/inspectTail/export, and a
-    // foreign address on anything else fails fast typed.
+    // Observation and checkpoints are lane-local: the closed route-capable store subset
+    // is materialize/append/read/inspectTail/export. Recovery cache misses can fall back
+    // to those canonical reads, including when the cache belongs to a foreign Object.
     observe: (request) =>
-      request.conversationId === options.localConversationId
+      options.ownsThread(request.threadId)
         ? local.observe(request)
-        : Stream.unwrap(
-            Effect.fail(
-              crossConversationStoreError("conversation observe", request.conversationId),
-            ),
-          ),
-
-    saveCheckpoint: (request) =>
-      request.checkpoint.conversationId === options.localConversationId
-        ? local.saveCheckpoint(request)
-        : Effect.fail(
-            crossConversationStoreError(
-              "conversation save checkpoint",
-              request.checkpoint.conversationId,
-            ),
-          ),
-
-    loadCheckpoint: (request) =>
-      request.conversationId === options.localConversationId
-        ? local.loadCheckpoint(request)
-        : Effect.fail(
-            crossConversationStoreError("conversation load checkpoint", request.conversationId),
-          ),
+        : Stream.unwrap(Effect.fail(crossThreadStoreError("thread observe", request.threadId))),
+
+    ...(recoveryCheckpoints === undefined
+      ? {}
+      : {
+          recoveryCheckpoints: {
+            save: (request) =>
+              options.ownsThread(request.checkpoint.threadId)
+                ? recoveryCheckpoints.save(request)
+                : Effect.fail(
+                    crossThreadStoreError(
+                      "thread save recovery checkpoint",
+                      request.checkpoint.threadId,
+                    ),
+                  ),
+            load: (request) =>
+              options.ownsThread(request.threadId)
+                ? recoveryCheckpoints.load(request)
+                : Effect.succeed(Option.none()),
+          },
+        }),
+    ...(checkpoints === undefined
+      ? {}
+      : {
+          checkpoints: {
+            save: (request) =>
+              options.ownsThread(request.checkpoint.threadId)
+                ? checkpoints.save(request)
+                : Effect.fail(
+                    crossThreadStoreError("thread save checkpoint", request.checkpoint.threadId),
+                  ),
+            load: (request) =>
+              options.ownsThread(request.threadId)
+                ? checkpoints.load(request)
+                : Effect.fail(crossThreadStoreError("thread load checkpoint", request.threadId)),
+          },
+        }),
   });
 
-  return Context.make(ConversationStore, routed);
+  return Context.make(ThreadStore, routed);
 });
 
 /**
  * Routing decorator over the LOCAL `SubmissionLedger` facet (plan §1.3): a request addressing
- * this Object's Conversation executes locally; a route-capable request addressing another
- * Conversation is Schema-encoded onto the `ConversationPortTransport` and executed by the
+ * this Object's Thread executes locally; a route-capable request addressing another
+ * Thread is Schema-encoded onto the `ThreadPortTransport` and executed by the
  * owning Object's local facet; any other foreign request fails fast typed. Provide the WP1
  * local facet (`submissionLedgerLayer`/`ledgerLayer`) and a transport to close it.
  */
 export const routedSubmissionLedgerLayer = (
   options: RoutedPortOptions,
-): Layer.Layer<SubmissionLedger, never, SubmissionLedger | ConversationPortTransport> =>
+): Layer.Layer<SubmissionLedger, never, SubmissionLedger | ThreadPortTransport> =>
   Layer.effectContext(makeRoutedLedgerServices(options));
 
 /**
- * Routing decorator over the LOCAL `ConversationStore` facet (plan §1.3): this-conversation
+ * Routing decorator over the LOCAL `ThreadStore` facet (plan §1.3): this-thread
  * requests execute locally; foreign materialize/append/read/inspectTail/export travel the
- * transport; foreign observation and checkpoints fail fast typed.
+ * transport. Foreign recovery-cache loads return none for canonical replay; other foreign
+ * checkpoint operations and observation fail fast typed.
  */
-export const routedConversationStoreLayer = (
+export const routedThreadStoreLayer = (
   options: RoutedPortOptions,
-): Layer.Layer<ConversationStore, never, ConversationStore | ConversationPortTransport> =>
+): Layer.Layer<ThreadStore, never, ThreadStore | ThreadPortTransport> =>
   Layer.effectContext(makeRoutedStoreServices(options));
 
 // ---------------------------------------------------------------------------
@@ -915,16 +937,17 @@ const capture = <Failure extends PortFailure>(
  * Execute one decoded port request against THIS Object's LOCAL facets — the owner-side half
  * of the routed ports (plan §1.3). Callers must provide the WP1 local facets, never the
  * routed decorators: the routing layer already established that this Object owns the
- * addressed Conversation, and re-routing here could bounce a request between Objects.
+ * addressed Thread, and re-routing here could bounce a request between Objects.
  * Failures never escape — every typed port failure becomes a `PortFailed` envelope that
  * re-decodes on the caller side.
  */
 export const executePortRequest = Effect.fn("DoPortRouting.executePortRequest")(function* (
   request: PortRequest,
-): Effect.fn.Return<PortResponse, never, SubmissionLedger | ConversationStore> {
+): Effect.fn.Return<PortResponse, never, SubmissionLedger | ThreadStore> {
   switch (request._tag) {
     case "LedgerAdmit": {
       const ledger = yield* SubmissionLedger;
+
       return yield* capture(
         ledger
           .admit(request.request)
@@ -933,12 +956,14 @@ export const executePortRequest = Effect.fn("DoPortRouting.executePortRequest")(
     }
     case "LedgerMarkReady": {
       const ledger = yield* SubmissionLedger;
+
       return yield* capture(
         ledger.markReady(request.request).pipe(Effect.map(() => LedgerMarkReadyResult.make({}))),
       );
     }
     case "LedgerLookup": {
       const ledger = yield* SubmissionLedger;
+
       return yield* capture(
         ledger
           .lookup(request.request)
@@ -953,6 +978,7 @@ export const executePortRequest = Effect.fn("DoPortRouting.executePortRequest")(
     }
     case "LedgerResolveAdmission": {
       const ledger = yield* SubmissionLedger;
+
       return yield* capture(
         ledger
           .resolveAdmission(request.request)
@@ -961,6 +987,7 @@ export const executePortRequest = Effect.fn("DoPortRouting.executePortRequest")(
     }
     case "LedgerRequestAbort": {
       const ledger = yield* SubmissionLedger;
+
       return yield* capture(
         ledger
           .requestAbort(request.request)
@@ -969,6 +996,7 @@ export const executePortRequest = Effect.fn("DoPortRouting.executePortRequest")(
     }
     case "LedgerRecordChildSettled": {
       const ledger = yield* SubmissionLedger;
+
       return yield* capture(
         ledger
           .recordChildSettled(request.request)
@@ -976,13 +1004,15 @@ export const executePortRequest = Effect.fn("DoPortRouting.executePortRequest")(
       );
     }
     case "StoreMaterialize": {
-      const store = yield* ConversationStore;
+      const store = yield* ThreadStore;
+
       return yield* capture(
         store.materialize(request.request).pipe(Effect.map(() => StoreMaterializeResult.make({}))),
       );
     }
     case "StoreAppend": {
-      const store = yield* ConversationStore;
+      const store = yield* ThreadStore;
+
       return yield* capture(
         store
           .append(request.request)
@@ -990,7 +1020,8 @@ export const executePortRequest = Effect.fn("DoPortRouting.executePortRequest")(
       );
     }
     case "StoreReadPage": {
-      const store = yield* ConversationStore;
+      const store = yield* ThreadStore;
+
       return yield* capture(
         store.read(request.request).pipe(
           Stream.runCollect,
@@ -999,7 +1030,8 @@ export const executePortRequest = Effect.fn("DoPortRouting.executePortRequest")(
       );
     }
     case "StoreInspectTail": {
-      const store = yield* ConversationStore;
+      const store = yield* ThreadStore;
+
       return yield* capture(
         store
           .inspectTail(request.request)
@@ -1007,15 +1039,12 @@ export const executePortRequest = Effect.fn("DoPortRouting.executePortRequest")(
       );
     }
     case "StoreExport": {
-      const store = yield* ConversationStore;
+      const store = yield* ThreadStore;
+
       return yield* capture(
         store
           .export(request.request)
-          .pipe(
-            Effect.map((conversationExport) =>
-              StoreExportResult.make({ export: conversationExport }),
-            ),
-          ),
+          .pipe(Effect.map((threadExport) => StoreExportResult.make({ export: threadExport }))),
       );
     }
   }
@@ -1039,9 +1068,7 @@ const encodedProtocolFailure = (message: string): unknown => ({
  * transport never has to interpret exceptions as protocol answers.
  */
 export const handleEncodedPortRequest = Effect.fn("DoPortRouting.handleEncodedPortRequest")(
-  function* (
-    encoded: unknown,
-  ): Effect.fn.Return<unknown, never, SubmissionLedger | ConversationStore> {
+  function* (encoded: unknown): Effect.fn.Return<unknown, never, SubmissionLedger | ThreadStore> {
     const response = yield* decodePortRequest(encoded).pipe(
       Effect.flatMap(executePortRequest),
       Effect.catch((error) =>
@@ -1056,6 +1083,7 @@ export const handleEncodedPortRequest = Effect.fn("DoPortRouting.handleEncodedPo
         ),
       ),
     );
+
     return yield* encodePortResponse(response).pipe(
       Effect.catch((error) =>
         Effect.succeed(